CVE-2026-92523 RDMA/nldev: validate dynamic counter attribute length

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...

CVE-2026-92512

A use-after-free vulnerability in the Linux kernel RDMA/core subsystem affects the ib_query_qp() function. When a QP is queried via the netlink resource tracking flow, the only synchronization is rdma_restrack_get() , but on the destroy path, rdma_restrack_del() is called too late—after vendor-sp...

EUVD-2026-82133

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ibqueryqp When querying a QP via the netlink flow the only synchronization mechanism for the said QP is rdmarestrackget, meanwhile during the QP destroy path rdmarestrackdel is called at the end o...

CVE-2026-92512 RDMA/core: Fix use after free in ib_query_qp()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ibqueryqp When querying a QP via the netlink flow the only synchronization mechanism for the said QP is rdmarestrackget, meanwhile during the QP destroy path rdmarestrackdel is called at the end o...

CVE-2026-92512 RDMA/core: Fix use after free in ib_query_qp()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ibqueryqp When querying a QP via the netlink flow the only synchronization mechanism for the said QP is rdmarestrackget, meanwhile during the QP destroy path rdmarestrackdel is called at the end o...

CVE-2026-92511 RDMA/core: Fix potential use after free in ib_destroy_cq_user()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroycquser When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-92511

CVE-2026-92511 is a use-after-free vulnerability in the Linux kernel's RDMA/core subsystem, specifically in ib_destroy_cq_user(). When a Completion Queue (CQ) is accessed via the netlink path, the only synchronization mechanism is rdma_restrack_get(). The flaw arises because rdma_restrack_del() w...

CVE-2026-92511 RDMA/core: Fix potential use after free in ib_destroy_cq_user()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroycquser When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

EUVD-2026-82132

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroycquser When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-92510 RDMA/core: Fix potential use after free in ib_destroy_srq_user()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroysrquser When accessing a SRQ via the netlink path the only synchronization mechanism for the said SRQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-92509 RDMA/core: Fix potential use after free in counter_release()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counterrelease When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end ...

EUVD-2026-82131

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroysrquser When accessing a SRQ via the netlink path the only synchronization mechanism for the said SRQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-92509

CVE-2026-92509 is a potential use-after-free in the Linux kernel RDMA/core subsystem, specifically in the counter_release() function. The root cause is a timing issue: rdma_restrack_del() was invoked at the end of counter_release(), after vendor-specific resources had already been freed. This lef...

EUVD-2026-82130

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counterrelease When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end ...

CVE-2026-92510

CVE-2026-92510 is a use-after-free in the Linux kernel's RDMA/core subsystem, specifically in ib_destroy_srq_user(). When a Shared Receive Queue (SRQ) is destroyed via the netlink path, rdma_restrack_del() was invoked at the end of the function—after vendor-specific resources may already be freed...

CVE-2026-92509 RDMA/core: Fix potential use after free in counter_release()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counterrelease When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end ...

CVE-2026-92510 RDMA/core: Fix potential use after free in ib_destroy_srq_user()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdestroysrquser When accessing a SRQ via the netlink path the only synchronization mechanism for the said SRQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-92508

CVE-2026-92508 is a potential use-after-free in the Linux kernel's RDMA/core subsystem, specifically in ib_free_cq(). When a Completion Queue (CQ) is accessed via the netlink path, rdma_restrack_del() was invoked only at the very end of ib_free_cq()—after vendor-specific resources had already bee...

EUVD-2026-82129

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...

CVE-2026-92508 RDMA/core: Fix potential use after free in ib_free_cq()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...